(RHSA-2014:1037) Moderate: cfme security and bug fix update

Red Hat CloudForms Management Engine delivers the insight, control, and
automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails, a
model-view-controller (MVC) framework for web application development.
Action Pack implements the controller and the view components.

It was found that the get and log methods of the AgentController wrote log
messages without sanitizing user input. A remote attacker could use this
flaw to insert arbitrary content into the log files written to by
AgentController. (CVE-2014-0136)

This issue was discovered by Jan Rusnacko of Red Hat Product Security.

This update also fixes several bugs. Documentation for these changes will
be available shortly from the Technical Notes document linked to in the
References section.

All users of Red Hat CloudForms 3.0 are advised to upgrade to these updated
packages, which correct these issues.